KRATOS 7691ff18f9 fix model-discovery fallback + redact opaque Authorization tokens (#266) ...

Two robustness/security bugs from a full-tree audit, each with a test.

- providermodeldiscovery: when a live /models probe succeeds (200) but its
  model ids don't match the curated catalog, the merge was empty and the whole
  live+curated list was discarded — the picker collapsed to the bare built-in
  set with a misleading "no model ids" error. Now fall back to the curated
  catalog instead of returning an empty list.
- redaction: Authorization / Proxy-Authorization headers carrying an opaque
  token or a custom (non-standard) scheme were not redacted in free text (logs,
  command/diff output, errors, session search), echoing live credentials back
  into model context and rendered output. The scheme is now optional, so any
  credential value is redacted to end-of-line; a recognized scheme name is
  still kept for readability.

2026-06-20 10:39:35 +05:30

..

audit_fixes_test.go

redaction: catch compound secret keys + non-bearer auth schemes; stop scanner over-redaction (#249)

2026-06-18 20:01:25 +05:30

opaque_auth_test.go

fix model-discovery fallback + redact opaque Authorization tokens (#266)

2026-06-20 10:39:35 +05:30

redaction_test.go

audit: fix isolated remaining findings (redaction, secrets, rune-safety, credential status) (#174)

2026-06-12 12:48:24 +05:30

redaction.go

fix model-discovery fallback + redact opaque Authorization tokens (#266)

2026-06-20 10:39:35 +05:30